|  | 3.4 | Benefits of VLANs
| 3.4.3 | How VLANs can improve network security

The use of LANs has increased at a very high rate over the past several years. As a result, LANs often have confidential, mission-critical data moving across them. Confidential data requires security through access restriction. One problem of shared LANs is that they are relatively easy to penetrate. By plugging in to a live port, an intrusive user has access to all traffic within the segment. The larger the group, the greater the potential access. One cost-effective and easy administrative technique to increase security is to segment the network into multiple broadcast groups which allows the network manager to: Restrict the number of users in a VLAN group Prevent another user from joining without first receiving approval from the VLAN network management application Configure all unused ports to a default low-service VLAN Implementing this type of segmentation is relatively straightforward. Switch ports are grouped together based on the type of applications and access privileges. Restricted applications and resources are commonly placed in a secured VLAN group. On the secured VLAN, the switch restricts access into the group. Restrictions can be placed based on station addresses, application types, or protocol types. You can add more security enhancements by using access control lists, which will be discussed in a later chapter. These are especially useful when communicating between VLANs. On the secured VLAN, the router restricts access to the VLAN as configured on both switches and routers. You can place restrictions on station addresses, application types, protocol types, or even by time of day.